Pulse
2026-09-18-v3.0
Dataset
2026-09-18-v3.0
Ruleset
b2e8889c66f7
Scanned
2026-09-16
Window
February–September 15, 2026
Local to this browser

01Result

aquasecurity/trivy ↗

aquasecurity/trivy AI coding statistics: 3.1%

of 229 commits in February–September 15, 2026 were committed by an AI agent — a floor, not an estimate
3.1% agent · top contributor 14.3%7 contributors
team

A small group is using agents. Adoption has spread beyond one person but is not project-wide.

7
agent commits
222
other considered commits
7
agent contributors
14.3%
largest contributor

02Drivers

What shapes this result

Mode, timing, and detected signatures show whether the result reflects broad adoption or one concentrated workflow.

Assisted or autonomous

7assisted
0autonomous

Assisted — a developer’s identity authored the commit and the agent added itself as co-author. Autonomous — a bot identity authored the commit without a human identity attached. Across the whole index, 96% of agent commits are assisted.

Agent share by month

Agent-attributed commit share by month
MonthAgent shareConsidered commits
2026-020%29
2026-030%24
2026-040%21
2026-052.6%38
2026-067%43
2026-0710.5%19
2026-083.6%28
2026-090%27

Peak month: 10.5%. Bars are scaled to that peak, not to 100%.

Which agents

AgentVendorCommitsShare
Claude CodeAnthropic62.6%
Cursor AgentAnysphere10.4%

03Evidence

Inspect the matches

Public commit samples let you inspect the signatures behind the aggregate result.

Matched commit samples

  • 38d5dbd2 on GitHubfeat(vex): native discovery of VEX documents stored as OCI artifacts (#109Claude Code
  • 69da7331 on GitHubfeat(seal): detect no-prefix packages by version suffix (#10911)Claude Code
  • 859a933c on GitHubfix: correct format verbs in diagnostic messages (#10805)Claude Code
  • 199a1262 on GitHubfix(terraform): avoid panic when for_each local has unknown object values Cursor Agent

04Method

What entered the denominator

The result begins with commit history, removes merges and routine automation, and reports literal agent signatures as a lower bound.

Exclusion ledger

Commits in window290
Merge commits removed−0
CI / dependency bots removed−61
Considered229

Bots are excluded from the denominator entirely. Agent attribution requires a literal supported signature; no code-style inference is used.

05Provenance

Pinned to a source state

This observation names the repository state, release, and detector that produced it. Use these identifiers when reproducing or citing the result.

Dataset release
2026-09-18-v3.0
Scan date
2026-09-16
Ruleset
sha256:b2e8889c66f72c18a61839f0bf1a9f77b5481ba2def044dba33c797b2f2bdcae
Canonical repository
aquasecurity/trivy
Default branch
main
Resolved HEAD
e97dfcc1bd777cdc85a2aedb52b761ea543b9ae0 ↗
Resolved
2026-09-16
Measurement window
February–September 15, 2026
Download observation JSONDeterministic export · same values as this page

06Peer context

Position among comparable repositories

The cohort uses the same release and measurement window, then narrows to the repository’s ecosystem and removes low-activity observations.

CohortGo · 132 eligible repositories · at least 100 considered commits2026-09-18-v3.0 · February–September 15, 2026 · 62 of 194 ecosystem repositories excluded
Agent-commit share position51st percentile

Midrank percentile; equal shares split the tied positions.

Repository
3.1%
Cohort median
2.8%
Share rank
65 / 132
0th50th100th

Percentile = (repositories below + half of 1 tied repository) ÷ 132.

Continue exploring

Claude Code commitsBrowse repositories with detected Claude Code signatures →Cursor Agent commitsBrowse repositories with detected Cursor Agent signatures →GitHub AI commit analyzerInspect another repository with the same evidence model →
Reproduce this observation

Run the same detector locally.

Deterministic signature matching; no code-style inference. Squash merges can remove trailers, so this result remains a measured floor.

npx qmmit-cli aquasecurity/trivy

Scan another repository

Try